PHP 8.4.26 session.upload_progress Remote Code Execution

PHP version 8.4.26 with Apache modphp contains a session.uploadprogress stale-pointer condition that can be exploited remotely without authentication to leak memory and execute commands. This proof of concept targets a pinned Docker image. https://packetstorm.news/download/236989...

PHP 8.5.11 Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an out-of-memory request parsing vulnerability that can lead to remote code execution. The included proof of concept targets Apache modphp using multipart form input and session upload progress handling...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP version 8.5.11 contains a use-after-free in session upload progress handling that can lead to remote code execution. This proof of concept targets an isolated local Apache container. https://packetstorm.news/download/236991...

PHP 8.5.11 Security Fix Tool

The php-cve-2026-fix tool audits PHP servers for two remote code execution vulnerabilities and can update affected Debian and Ubuntu packages, apply configuration hardening, and verify services...

CentOS Linux 6 [TuxCare] Security Update: libX11 / libX11-common / libX11-devel Multiple Vulnerabilities (CENTOS6:CLSA-2026:1792609205)

The CentOS Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1792609205 advisory. - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the firs...

PHP 5.3.29 / 5.4.16 / 7.3.33 Remote Code Execution

PHP versions 5.3.29, 5.4.16, and 7.3.33 backport minimal mitigations for remote code execution issues caused by out-of-memory corruption and stale global state...

PHP 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34 Remote Code Execution

PHP versions before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain out-of-memory corruption and stale request-owned global state flaws that can allow unauthenticated remote code execution. This submission provides vulnerability information and cPanel EasyApache 4 partial mitigation guidance...

PHP 8.1 FPM Memory Corruption Fixes

PHP versions 5.0 through 8.1 contain memory-state corruption flaws that can lead to remote code execution. This release provides backported patches, Dockerfiles, and validation tools for PHP-FPM and related images...

PT-2026-134888

Two critical PHP vulnerabilities that can allow unauthenticated remote code execution have been fixed. The updated packages should be installed as soon as possible...

CentOS Linux 7 [TuxCare] Security Update: gstreamer1-plugins-bad-free / gstreamer1-plugins-bad-free-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792562667)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792562667 advisory. - GStreamer JPEG Parser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to...

Microsoft Office Code Execution

The vulnerability of Microsoft Word packages in Microsoft Office and Microsoft 365 Apps for Enterprise is related to a numerical overflow vulnerability. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

PHP 8.5.11 Remote Code Execution Check

PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain two unauthenticated remote code execution vulnerabilities. The supplied shell script checks installed PHP versions, relevant configuration, and whether workers require restarting...

Drupal Patreon security vulnerability

A security vulnerability exists in Drupal Patreon version 7.x. It stems from an unknown error that allows remote administrators to pass specially crafted input to the application, thereby executing arbitrary code on the system...

CVE-2026-51954

An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirecturi...

Microsoft Windows Server 2022 10.0.20348.1 Remote Desktop Protocol Remote Code Execution

Microsoft Windows Server 2022 version 10.0.20348.1 contains an uninitialized resource vulnerability in Remote Desktop Protocol that allows an unauthenticated attacker to execute code over a network...

NVIDIA Megatron Bridge YAML File Parsing Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of NVIDIA Megatron Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handlin...

Cisco Snort OLE VBA Decompression Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Cisco Snort. Authentication is not required to exploit this vulnerability. The specific flaw exists within the decompression of VBA data in OLE file streams. The issue results from the lack of proper...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a buffer overflow flaw in the affected interface. By sending specially crafted packets to this interface, attackers can achieve unauthenticated remote code execution. Exploiting this vulnerability allows arbitrary code execution with...

CVE-2026-51954

The Webasyst Framework (version 4.0.3 and before ) contains an OAuth 2.0 implementation flaw where the redirect_uri parameter is not properly validated. A remote, unauthenticated attacker can exploit this by providing a crafted OAuth authorization URL to intercept authorization credentials. Succe...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a remote code execution flaw in the underlying operating system. Unauthenticated neighboring attackers can execute arbitrary code on affected devices. Successful exploitation allows attackers to run arbitrary commands with privileged...